What does depproof do?

depproof resolves the full transitive dependency tree across Java, JavaScript, Python, and Go projects. It classifies every dependency's license, screens components against OSV advisory data, and produces an HTML report and CycloneDX SBOM. It runs as a GitHub Action or self-hosted container, with your code and findings never leaving your infrastructure.

Which programming languages and package managers does depproof support?

depproof supports four ecosystems: the JVM with Maven and Gradle, JavaScript/Node with npm, pnpm, yarn, and bun, Python with PyPI, and Go with modules. Maven resolves the full tree directly from source with no build, while Gradle, npm, Python, and Go all resolve from their respective lock files or module graphs.

Does depproof send my code or data to the cloud?

No. depproof runs entirely on your own infrastructure in your CI or on your machine. Your code and findings never leave your network. The scanner only looks up dependency coordinates against public sources like OSV.dev, never your source code. With the depproof hub, lookups go to your own hub instead, with no account, API key, or telemetry required.

How much does depproof cost?

The Scanner is free for open-source projects and organizations with under $1M revenue. For larger organizations, the Scanner license adds priority support and policy templates. The Hub is an additional product for organization-wide governance on your own infrastructure, with custom pricing. You pay per product, not per seat, committer, or application.

Is depproof difficult to operate?

No. depproof is a single container that scans and exits with nothing to install on build agents and nothing running between scans. It requires no standing service, HA cluster, or platform team to operate, making it a lightweight alternative to heavy self-hosted governance solutions.

Security, Privacy & Compliance

depproof

Self-hosted application security and software composition analysis for open-source dependencies

0 votes. Log in to rate depproof up Follow change log. Log in to follow depproof's change log

Application security and software composition analysis that runs on your own infrastructure to check open-source dependencies for vulnerabilities, license

Overview

A look at depproof.com

depproof is a self-hosted application security platform that analyzes open-source dependencies across Java, JavaScript, Python, and Go projects. It resolves the full transitive dependency tree, classifies every dependency's license, and screens components against OSV advisory data, producing an HTML report and CycloneDX SBOM as a GitHub Action or self-hosted container.

The platform runs entirely on your own infrastructure—your code and findings never leave your network. It supports multiple package managers including Maven, Gradle, npm, pnpm, yarn, bun, PyPI, and Go modules. For organizations needing organization-wide governance, depproof offers the Hub, which aggregates reports across all repositories into a cross-repo dashboard with blast-radius search and SBOM management.

The Scanner is free for open-source projects and organizations under $1M revenue. For larger organizations, the Scanner adds additional features including priority support and policy templates, while the Hub provides org-wide dashboards and waivers with audit trails.

Feature notes

Full transitive dependency tree resolution for Java, JavaScript, Python, and Go
License classification and audit with allowed, review, and forbidden categories
OSV advisory screening for vulnerability detection
CycloneDX SBOM generation on every scan
CI gate with configurable fail-on levels
Dev and test dependency detection and flagging
Runs as GitHub Action or self-hosted container
Waivers with append-only audit trail for Hub
Coverage reporting showing how much of dependency tree was resolved

Pricing

Pricing model: Freemium

Scanner: Free for open source and organizations under $1M revenue; includes every repository, full transitive resolution for Java, JavaScript, Python, Go, license audit, OSV advisories with CI gate, HTML report and CycloneDX SBOM. Over $1M revenue, the Scanner license adds priority support and polic

Follow change log. Log in to follow depproof's change log

Follow depproof to get an email when they post a milestone, ship a new product or add a demo video.

depproof at a glance

Community votes: 0
Followers: 0

depproof metrics

Inspection sheet for depproof.com: Ahrefs Domain Rating and Majestic link metrics, with the delta since the last inspection.
Metric	Value
Domain Rating	14 no change since last check
Trust Flow	5 no change since last check
Citation Flow	24 no change since last check
Referring domains	24 no change since last check
External backlinks	69 no change since last check

Domain Rating by Ahrefs inspected 6 Nov 2026, adjusted 4 Nov 2026. Primary topic: Computers/Programming/Languages (4). Majestic inspected 4 Nov 2026, adjusted 4 Nov 2026. Link data: Majestic. Trust Flow, Citation Flow and Topical Trust Flow are trademarks of Majestic-12 Ltd.

depproof domain diagnostics

Run through the diagnostics

Public RDAP record, last read 6 Nov 2026, 03:08 UTC.
Domain age	3 months
Registered	13 Jul 2026
Expires	13 Jul 2027
Registrar	HOSTINGER operations, UAB
DNSSEC	Not signed

Run the full check on depproof.com

depproof post-launch diagnostics

Measured after depproof went live on Launching Pro on 4 November 2026.

Domain Rating (Ahrefs): 14 no change since launch; 14 at launch (4 Nov 2026), 14 on 6 Nov 2026
Trust Flow (Majestic): 5; First measured 4 Nov 2026
Referring domains (Majestic): 24; First measured 4 Nov 2026

Day 2 since launch. Next receipt: day 30, 4 Dec 2026. The figures report a change; they do not say what caused it, and many things can. No figure here is a guess.

Biggest gains on Launching Pro

Launch tips, free to read

The playbook on Launching Pro lists what to prepare, what to post on launch day and where else to list your product.

Before the day
Launch day
That week
Beyond launch

See the launch playbook

Compare and explore

FAQ

What does depproof do?: depproof resolves the full transitive dependency tree across Java, JavaScript, Python, and Go projects. It classifies every dependency's license, screens components against OSV advisory data, and produces an HTML report and CycloneDX SBOM. It runs as a GitHub Action or self-hosted container, with your code and findings never leaving your infrastructure.
Which programming languages and package managers does depproof support?: depproof supports four ecosystems: the JVM with Maven and Gradle, JavaScript/Node with npm, pnpm, yarn, and bun, Python with PyPI, and Go with modules. Maven resolves the full tree directly from source with no build, while Gradle, npm, Python, and Go all resolve from their respective lock files or module graphs.
Does depproof send my code or data to the cloud?: No. depproof runs entirely on your own infrastructure in your CI or on your machine. Your code and findings never leave your network. The scanner only looks up dependency coordinates against public sources like OSV.dev, never your source code. With the depproof hub, lookups go to your own hub instead, with no account, API key, or telemetry required.
How much does depproof cost?: The Scanner is free for open-source projects and organizations with under $1M revenue. For larger organizations, the Scanner license adds priority support and policy templates. The Hub is an additional product for organization-wide governance on your own infrastructure, with custom pricing. You pay per product, not per seat, committer, or application.
Is depproof difficult to operate?: No. depproof is a single container that scans and exits with nothing to install on build agents and nothing running between scans. It requires no standing service, HA cluster, or platform team to operate, making it a lightweight alternative to heavy self-hosted governance solutions.

Leave a review for depproof

No reviews of depproof yet. Run the first inspection.

Reviews are free and are never paid for. Open the reviews

Reviews and notes · Change log · Share the profile · Maker of this product? Claim the profile · Report a fault

Comparable tools

VigilanceDR 5 · 0 community votes
ctlogs.devDR 38 · 0 community votes
KeyEnvDR 8 · 0 community votes
OrionAlertsDR 0 · 0 community votes

Feature notes

Pricing

Compare and explore

Leave a review for depproof

More on this profile